[FulcrumSec]

First of all, we'd like to announce that FulcrumSec has a NEW CLEARNET DOMAIN

 https://fulcrum.st/

Keep an eye on it for new breaches dropping weekly.

---

Who Stuf Storage is

Stuf Storage (legally Stuuf Inc., New York, May 2020) converts underutilised commercial space into tech-enabled self-storage. Fast Company Most Innovative Companies 2022. Founder Katharine Lau on Inc. Female Founders 100. Total raised: $12.8 million (Wilshire Lane, Harlem Capital, Altos Ventures, Allegion Ventures). 39 facilities across 9 US cities, operated by 3 staff.

In 2025, Stuf launched Sidney AI -- a voice agent built on ElevenLabs that handles inbound calls, sends SMS follow-ups, and transcribes every conversation. Now being marketed to other storage operators as standalone SaaS.

Lau told Crunchbase that Stuf's "default solution to most problems is tech, not people." We are now in a position to show what that produced.

---

What We Exfiltrated

287 GB across 31 S3 buckets on AWS account 163511501737. Two production PostgreSQL databases replicated to S3 as partitioned CSV exports.

• 5,118 storage rental contracts -- full customer names, phone numbers, unit assignments, pricing
  
• 3,798 unique customer names from signed rental agreement PDFs
  
• 9,111 call recordings (3.8 GB) -- customer conversations via Telzio
  
• 7,362 call logs with AI-generated transcripts, sentiment analysis, phone numbers
  
• 10,231 SMS messages with personalised booking links
  
• 137,297 physical access unlock events with GPS coordinates
  
• 2,257 unit lock codes and 11 facility entry codes
  
• 40 GB source code -- 22 CodePipeline repos (Sidney AI, StufOS, stufstorage.com)
  
• 6 API credential sets (Stuf, Sidney, MiniCo, DSX, Marea, StufLambda)
  
• 20 platform user accounts including 12 external demo accounts -- revealing Sidney AI's active sales pipeline
  
  

We are not releasing the lock codes. More on this below.

Everything else you can download here: 
EDIT: ADDED TORRENT DOWNLOAD LINK

Hidden Content

You must register or login to view this content.

---

9,111 Calls. Zero Consent.

Every Sidney AI call begins the same way: "Thanks for calling Stuf Storage. This is Sidney. Can I please get your first name?"
No recording disclosure. No consent request. Just a friendly AI collecting your name, your situation, your personal circumstances -- and recording every word.

California Penal Code §632 requires all-party consent. So does Washington RCW 9.73.030. Stuf operates facilities in both states. 9,111 calls recorded without evidence of consent. Statutory exposure under §632 alone: $2,500 per violation.

We listened to a sample and reviewed over a thousand transcripts. What follows is a selection of what the AI captured.

---

The Recordings

A man named Ronald called because his work keys were locked in his unit and he was about to lose his job: "This is imperative to my life. This is really going to hurt my entire life if I can't get in there for two minutes... Oh my God, I'm fucked. I'm going to lose my job." That recording is still sitting in an S3 bucket. There is no data retention policy that distinguishes it from a sales inquiry.

One recording is just a person crying. A caller from a Los Angeles number -- no name on file. The transcript captures three words: "Help! Immediate assistance." The AI logged it as "active distress" and filed it alongside 9,110 other recordings. Nobody deleted it. Nobody flagged it. Nobody at any point asked whether a recording of someone sobbing for help needed to be kept forever next to their lock codes and GPS coordinates.

Rachel was on the line for over eighty minutes -- 4,828 seconds -- incoherent, explicitly stating "I'm not good." The AI kept listening. Nobody intervened.

Marcus Lucas: "I just got out of jail. It's been a month, and I just got out of jail, so I want to know how long until I can pay it." Full name and incarceration history exposed in audio and text transcript.

A caller disclosed a medical condition on a recorded line after staff misdirected her: "I peed my pants because I have a medical condition that causes me to lose my bowels and stuff."

A caller asked about "storage rates for low income. And homeless situation."

These are people in crisis -- homeless, recently incarcerated, fleeing violence, in medical emergencies. Their most vulnerable moments are in the data. They did not agree to be recorded. And Stuf stored those recordings in the same infrastructure it used to store lock codes, with the same level of protection it afforded its font files.

---

The Transcripts

A confirmed break-in: Max Lee called twice -- "The unit was actually robbed. Someone broke into it and took all of my stuff. There's nothing in there anymore."

An agent read a full credit card number on a recorded line: "Did you have 4436033149432103?" -- a complete 16-digit card and expiration, transcribed and stored. Textbook PCI-DSS violation.

Agent Kendall left a voicemail: "That lock code for Unit 69 is 1022." A unit number and its lock combination, on a recorded line, in the archive.

An agent told a customer to try what appears to be a universal bypass: "Try 0000 for me, the combination. Yeah, and then you're going to squeeze the lock from the top to the bottom." If this is in fact a universal bypass for all lock codes, our redaction of them in the data hardly matters.

Agent Ashley remotely unlocked a unit based on nothing but a name: "You said your name is? Sarah Fillmore... 6300 Wilshire Boulevard? Let me unlock it for you." No PIN. No passcode. No verification.

An Uber driver was told to leave a customer's unit unlocked and throw away the lock: "She asked me to throw it away. Can I do that?" -- "Yes, okay. Not a problem."

An agent told a customer to take a lock from someone else's unit: "Can we just look for an open unit and if there's a lock inside? Yes, please do that."

A customer was trapped inside a facility: "I'm locked inside of the facility and I can't get out."

Angela reported visiting twice to find the building wide open: "The gate was open, the door was open. Anybody could wander off, go in."

Nicholas reported a ceiling collapse: "The roof is like broke and is on the ground, and there's a bunch of wires hanging from the roof."

Jennifer's belongings were moved between units without her knowledge or consent. A $25,000 art piece was damaged: "It's a $25,000 cube, and there's chips all around the edge... that rug wasn't rolled anymore. It was crumpled together like a wonton."

Rafaela was given access codes that opened other people's units: "Unit 26 is definitely not mine. That's not the code, and there's a bunch of stuff in it." Then stranded on the street: "Literally all my stuff is outside and I Ubered here."

Agent Lachey confirmed a customer could rent without ID: "Yes, sir, you would be able to, it wouldn't be an issue." 

Three staff. Thirty-nine facilities. This is what happens.

---

The Lock Codes (REDACTED)

2,257 unit lock codes. 11 facility entry codes. Combined with the contract database (customer → facility → unit number), the GPS data (visit patterns by day and hour), and the call transcripts -- a complète physical access package for every customer in the system.
We are not publishing the unit lock codes. We have redacted them from the archive. An attacker with this data and the codes could walk into a building, locate a unit, open it, and know from the GPS patterns when the owner is least likely to visit.

The facility entry codes: we gave Stuf Storage sufficient advance notice to change all 11. We assume they have.

But we want to illustrate the scope. For a sample customer:

NAME:      Dawn Ferguson PHONE:      13479384808 FACILITY:    L0028 — 485 Clermont Ave, Brooklyn NY UNIT:        2718    |  $346/mo  |  Active BUILDING CODE: 8540  UNIT CODE:    [REDACTED] GPS EVENTS:  1,824 tracked visits   Peak Day: Thursday  |  Peak Hour: 16:00   Pattern: Heavy Mon-Tue-Thu, light weekends   Safe window for theft: Saturday/Sunday CALLS ON FILE: 7   - Reported being charged insurance for former unit, requested refund   - Couldn't get into facility, Emily let her in remotely   - Requested remote door access, asked for digital key setup SMS: 3 messages

This profile can be assembled for any of the 3,830 correlated customers in under thirty seconds using phone number as a join key.

---

137,297 GPS Events

Every facility door unlock is logged with GPS coordinates. 137,297 events. Date range: August 2022 to present. The ten most-surveilled customers have between 697 and 2,851 tracked events each.

Stuf's own CEO appears in the dataset: 131 events. Surveilled by her own platform.

---

To Stuf Storage

We wish you would have listened when we told you this release would be damaging. You should have taken us up on the cats. The responsibility for this breach and data leak falls entirely on you.

You replicated your production database -- 2,257 lock codes, the physical combinations to your customers' belongings -- as CSV exports to S3 buckets on the same account as your source code, your AI transcripts, and your GPS tracking data. You built a security system around physical access to strangers' property and dumped the keys into cloud storage.

You recorded thousands of calls without consent in two-party consent states. You captured homeless callers, incarcerated callers, people in medical crises -- and stored those recordings with the same protection you gave your font files.

You ran 39 facilities with 3 staff. The transcripts document the result: break-ins, entrapment, property damage, agents handing out lock codes over the phone, an Uber driver told to throw away a lock. This is what "tech, not people" looks like when the tech is built without security and the people aren't given the resources to manage what the tech cannot.

To Stuf's Customers

If you have rented a unit from Stuf Storage, your data is likely in this archive. Lock codes have been redacted. If you would like your data removed, contact us at [email protected] or [email protected]. We will honour all individual removal requests.

See the full post with more detail on our NEW CLEARNET DOMAIN: https://fulcrum.st/stuf/

[adelardsyah]

First of all, we'd like to announce that FulcrumSec has a NEW CLEARNET DOMAIN

 https://fulcrum.st/

Keep an eye on it for new breaches dropping weekly.

---

Who Stuf Storage is

Stuf Storage (legally Stuuf Inc., New York, May 2020) converts underutilised commercial space into tech-enabled self-storage. Fast Company Most Innovative Companies 2022. Founder Katharine Lau on Inc. Female Founders 100. Total raised: $12.8 million (Wilshire Lane, Harlem Capital, Altos Ventures, Allegion Ventures). 39 facilities across 9 US cities, operated by 3 staff.

In 2025, Stuf launched Sidney AI -- a voice agent built on ElevenLabs that handles inbound calls, sends SMS follow-ups, and transcribes every conversation. Now being marketed to other storage operators as standalone SaaS.

Lau told Crunchbase that Stuf's "default solution to most problems is tech, not people." We are now in a position to show what that produced.

---

What We Exfiltrated

287 GB across 31 S3 buckets on AWS account 163511501737. Two production PostgreSQL databases replicated to S3 as partitioned CSV exports.

• 5,118 storage rental contracts -- full customer names, phone numbers, unit assignments, pricing
  
• 3,798 unique customer names from signed rental agreement PDFs
  
• 9,111 call recordings (3.8 GB) -- customer conversations via Telzio
  
• 7,362 call logs with AI-generated transcripts, sentiment analysis, phone numbers
  
• 10,231 SMS messages with personalised booking links
  
• 137,297 physical access unlock events with GPS coordinates
  
• 2,257 unit lock codes and 11 facility entry codes
  
• 40 GB source code -- 22 CodePipeline repos (Sidney AI, StufOS, stufstorage.com)
  
• 6 API credential sets (Stuf, Sidney, MiniCo, DSX, Marea, StufLambda)
  
• 20 platform user accounts including 12 external demo accounts -- revealing Sidney AI's active sales pipeline
  
  

We are not releasing the lock codes. More on this below.

Everything else you can download here: 

---

9,111 Calls. Zero Consent.

Every Sidney AI call begins the same way: "Thanks for calling Stuf Storage. This is Sidney. Can I please get your first name?"
No recording disclosure. No consent request. Just a friendly AI collecting your name, your situation, your personal circumstances -- and recording every word.

California Penal Code §632 requires all-party consent. So does Washington RCW 9.73.030. Stuf operates facilities in both states. 9,111 calls recorded without evidence of consent. Statutory exposure under §632 alone: $2,500 per violation.

We listened to a sample and reviewed over a thousand transcripts. What follows is a selection of what the AI captured.

---

The Recordings

A man named Ronald called because his work keys were locked in his unit and he was about to lose his job: "This is imperative to my life. This is really going to hurt my entire life if I can't get in there for two minutes... Oh my God, I'm fucked. I'm going to lose my job." That recording is still sitting in an S3 bucket. There is no data retention policy that distinguishes it from a sales inquiry.

One recording is just a person crying. A caller from a Los Angeles number -- no name on file. The transcript captures three words: "Help! Immediate assistance." The AI logged it as "active distress" and filed it alongside 9,110 other recordings. Nobody deleted it. Nobody flagged it. Nobody at any point asked whether a recording of someone sobbing for help needed to be kept forever next to their lock codes and GPS coordinates.

Rachel was on the line for over eighty minutes -- 4,828 seconds -- incoherent, explicitly stating "I'm not good." The AI kept listening. Nobody intervened.

Marcus Lucas: "I just got out of jail. It's been a month, and I just got out of jail, so I want to know how long until I can pay it." Full name and incarceration history exposed in audio and text transcript.

A caller disclosed a medical condition on a recorded line after staff misdirected her: "I peed my pants because I have a medical condition that causes me to lose my bowels and stuff."

A caller asked about "storage rates for low income. And homeless situation."

These are people in crisis -- homeless, recently incarcerated, fleeing violence, in medical emergencies. Their most vulnerable moments are in the data. They did not agree to be recorded. And Stuf stored those recordings in the same infrastructure it used to store lock codes, with the same level of protection it afforded its font files.

---

The Transcripts

A confirmed break-in: Max Lee called twice -- "The unit was actually robbed. Someone broke into it and took all of my stuff. There's nothing in there anymore."

An agent read a full credit card number on a recorded line: "Did you have 4436033149432103?" -- a complete 16-digit card and expiration, transcribed and stored. Textbook PCI-DSS violation.

Agent Kendall left a voicemail: "That lock code for Unit 69 is 1022." A unit number and its lock combination, on a recorded line, in the archive.

An agent told a customer to try what appears to be a universal bypass: "Try 0000 for me, the combination. Yeah, and then you're going to squeeze the lock from the top to the bottom." If this is in fact a universal bypass for all lock codes, our redaction of them in the data hardly matters.

Agent Ashley remotely unlocked a unit based on nothing but a name: "You said your name is? Sarah Fillmore... 6300 Wilshire Boulevard? Let me unlock it for you." No PIN. No passcode. No verification.

An Uber driver was told to leave a customer's unit unlocked and throw away the lock: "She asked me to throw it away. Can I do that?" -- "Yes, okay. Not a problem."

An agent told a customer to take a lock from someone else's unit: "Can we just look for an open unit and if there's a lock inside? Yes, please do that."

A customer was trapped inside a facility: "I'm locked inside of the facility and I can't get out."

Angela reported visiting twice to find the building wide open: "The gate was open, the door was open. Anybody could wander off, go in."

Nicholas reported a ceiling collapse: "The roof is like broke and is on the ground, and there's a bunch of wires hanging from the roof."

Jennifer's belongings were moved between units without her knowledge or consent. A $25,000 art piece was damaged: "It's a $25,000 cube, and there's chips all around the edge... that rug wasn't rolled anymore. It was crumpled together like a wonton."

Rafaela was given access codes that opened other people's units: "Unit 26 is definitely not mine. That's not the code, and there's a bunch of stuff in it." Then stranded on the street: "Literally all my stuff is outside and I Ubered here."

Agent Lachey confirmed a customer could rent without ID: "Yes, sir, you would be able to, it wouldn't be an issue." 

Three staff. Thirty-nine facilities. This is what happens.

---

The Lock Codes (REDACTED)

2,257 unit lock codes. 11 facility entry codes. Combined with the contract database (customer → facility → unit number), the GPS data (visit patterns by day and hour), and the call transcripts -- a complète physical access package for every customer in the system.
We are not publishing the unit lock codes. We have redacted them from the archive. An attacker with this data and the codes could walk into a building, locate a unit, open it, and know from the GPS patterns when the owner is least likely to visit.

The facility entry codes: we gave Stuf Storage sufficient advance notice to change all 11. We assume they have.

But we want to illustrate the scope. For a sample customer:

NAME:      Dawn Ferguson PHONE:      13479384808 FACILITY:    L0028 — 485 Clermont Ave, Brooklyn NY UNIT:        2718    |  $346/mo  |  Active BUILDING CODE: 8540  UNIT CODE:    [REDACTED] GPS EVENTS:  1,824 tracked visits   Peak Day: Thursday  |  Peak Hour: 16:00   Pattern: Heavy Mon-Tue-Thu, light weekends   Safe window for theft: Saturday/Sunday CALLS ON FILE: 7   - Reported being charged insurance for former unit, requested refund   - Couldn't get into facility, Emily let her in remotely   - Requested remote door access, asked for digital key setup SMS: 3 messages

This profile can be assembled for any of the 3,830 correlated customers in under thirty seconds using phone number as a join key.

---

137,297 GPS Events

Every facility door unlock is logged with GPS coordinates. 137,297 events. Date range: August 2022 to present. The ten most-surveilled customers have between 697 and 2,851 tracked events each.

Stuf's own CEO appears in the dataset: 131 events. Surveilled by her own platform.

---

To Stuf Storage

We wish you would have listened when we told you this release would be damaging. You should have taken us up on the cats. The responsibility for this breach and data leak falls entirely on you.

You replicated your production database -- 2,257 lock codes, the physical combinations to your customers' belongings -- as CSV exports to S3 buckets on the same account as your source code, your AI transcripts, and your GPS tracking data. You built a security system around physical access to strangers' property and dumped the keys into cloud storage.

You recorded thousands of calls without consent in two-party consent states. You captured homeless callers, incarcerated callers, people in medical crises -- and stored those recordings with the same protection you gave your font files.

You ran 39 facilities with 3 staff. The transcripts document the result: break-ins, entrapment, property damage, agents handing out lock codes over the phone, an Uber driver told to throw away a lock. This is what "tech, not people" looks like when the tech is built without security and the people aren't given the resources to manage what the tech cannot.

To Stuf's Customers

If you have rented a unit from Stuf Storage, your data is likely in this archive. Lock codes have been redacted. If you would like your data removed, contact us at [email protected] or [email protected]. We will honour all individual removal requests.

See the full post with more detail on our NEW CLEARNET DOMAIN: https://fulcrum.st/stuf/

holy crap this is amazing

[RoavingRAT]

love it thanks

[YAninx]

Thanks Much appreciated.

[Stiven34]

i check this

[zalthorian]

Thanks

[hotpotsoupx1]

thanks folks

[TR054er]

thanks

[Hoover]

that's nice

[cxijdnjcdik]

thank you